Where card data stops touching the shop
Rouslan Trouchkovskii draws the payment boundary before integration work starts. Card data must not land in the shop database or session store.
PayPal, Stripe and Klarna use hosted fields or redirects that keep PAN and CVV off the application servers United Solutions operates for the catalog.
OAuth, webhooks and reconciliation each get a named service on the diagram. An alert without that name is adjusted before production traffic.
PCI scope follows the drawing, not the wish list. A shortcut that widens scope is rejected or moved to a provider path that keeps the shop out of scope.
What matters
- Card data stays off shop servers
- Providers use hosted or redirect flows
- Webhooks and OAuth on named services
- Scope follows the boundary diagram
Frequently asked questions
Does this replace a PCI audit?
No. The work implements architecture that matches PCI-DSS expectations. Formal certification stays with the acquirer and QSA process of the merchant.
Can Klarna and PayPal share one session?
Only if the session store never holds card data and the diagram shows separate callback URLs per provider.
More in the house: Rouslan Trouchkovskii, Cyber security, Cyber security from the start, Contact.
All posts